On Thursday, January 11, Microsoft filed its brief in the U.S. v Microsoft case set to go before the Supreme Court in the 2017-2018 term. The central question in the case is whether the Stored Communications Act allows the U.S. government to compel an electronic services provider, through a probable-cause-based warrant, to disclose electronic communications stored abroad.  For further background on this case, see our past coverage on the IELR Blog here and here.

Microsoft argues that Congress did not envision the Stored Communications Act to apply overseas. In 1986, when the statute was enacted, it was unimaginable that one day governments could secure data from overseas rapidly and inexpensively. Under the presumption against extraterritoriality established by Supreme Court precedent, legislation does not apply extraterritorially unless Congress clearly states or intends otherwise. Thus, the SCA has no extraterritorial application.

According to Microsoft, a warrant that compels the copying and importation of electronic communications stored overseas is an impermissible application of the SCA. The government argues that it is seeking a domestic application of the warrant, because the ultimate disclosure of the emails would occur in the U.S. But the SCA protects the security of “communications in electronic storage,” not “disclosure.” Thus, the Court should interpret the statute to apply to “domestically stored communications,” not “domestic disclosures of communications.” It follows that a warrant seeking to compel the disclosure of communications stored abroad (regardless of where they are ultimately disclosed) is extraterritorial.

Microsoft then scrutinizes the Government’s claim that “a person who complies with a subpoena [cannot] become a government agent simply by collecting and producing evidence in its possession.” Microsoft denounces the claim as misleading; the act of copying and disclosing the email content to the Government would involve the execution of a warrant, not a subpoena.

Interestingly, Microsoft cites the “international discord” over the case as confirmation” that “the warrant entails an impermissible extraterritorial application of the SCA.” Indeed, U.S. v. Microsoft is unusual for the amount of interest and input it has generated from foreign governments, companies, non-profits, and individuals. In a blog post  published on January 19, 2018, Microsoft’s President and Chief Legal Officer, Brad Smith, noted that thus far 23 amicus briefs by 289 entities and from 37 countries have been submitted in support of Microsoft.  Even more striking is the sheer range of political ideologies among the supporters. U.S. Senators Orrin Hatch (R-UT) and Christopher Coons (D-DE), the Chamber of Commerce, the ACLU, Vox Media and Fox News are among the domestic supporters.

See the full list of signatories here.

On December 13, 2017, the European Commission filed an amicus brief in the United States v. Microsoft Corp case set to go before the U.S. Supreme Court in the 2018 term. The case concerns the U.S. Justice Department’s access to an individual’s private emails stored at Microsoft’s Dublin data center. In December 2013, the DOJ served Microsoft a warrant compelling it to disclose the private communications of an individual the government had reason to believe was engaged in criminal drug activity.  When Microsoft turned over the account information stored on its U.S. servers, but refused to disclose the information stored at its Dublin center, the legal battle ensued.

At Issue: The Extraterritorial Application of the Stored Communications Act’s Warrant Provisions

The Stored Communications Act (SCA) – which is part of the broader Electronic Communications Privacy Act (ECPA) of 1986 – allows the government to require that an electronic communications provider disclose information about a particular communication upon being served a probable-cause-based warrant.  At issue in this case is whether the warrant provisions of the Stored Communications Act (SCA) apply extraterritorially, such that they compel Microsoft, an electronic service provider, to produce private electronic communications stored on servers in Ireland for the United States government.

The European Commission’s Brief

While the Commission stresses that the EU takes “no position on the ultimate question of the Stored Communication Act’s proper construction under U.S. law,” it nevertheless implores  that the Supreme Court consider EU data protection laws, particularly the General Data Protection Regulation (GDPR) set to go into effect in May 2018, when making its decision. The Commission argues that the GDPR applies in this case because the actions Microsoft must take to fully comply with the Justice Department’s warrant constitutes data “processing” to and from the European Union.

Chapter 5 of the GDPR explicitly addresses the transfer of data from the EU to a non-member state.  The GDPR specifies two main circumstances under which personal data may be transferred from the European Union to a non-member state:

• Article 47 allows transfers in cases in which the Commission has ruled that the third party’s data protection laws provide an “adequate level of protection.” In determining the adequacy of a particular data protection regime, the Commission examines the third party’s rule of law and the presence and functioning of relevant regulatory authorities, among other elements.
• In the absence of the provisions in Article 47 being satisfied, Article 48 allows transfers to a third party if the data controller or processor has ensured “appropriate safeguards,” which many include standard data protection clauses, binding enforcement authority, and legal recourse for data subjects, among other guarantees.

In cases that do not resemble either of the above circumstances, Article 49 outlines “derogations for specific situations.” In its brief, the Commission identifies two provisions that are most relevant to the case at hand:

• When a transfer is “necessary for important reasons of public interest;” and
• When a transfer is “necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interest or rights and freedoms of the data subject.”

With regards to the first provision, the Commission concedes that the Justice Department’s request for data generally would be seen as meant to further an “objective general interest:” the “fight against serious crime, a well as “criminal law enforcement and international cooperation in that respect.”

With regards to the second provision, however, the Commission is vaguer. It remains an open question whether the interests, however legitimate, underlying the Justice Department’s request for data override “the interests or rights and freedoms of the data subject.” Thus, while the Commission abstains from siding with either party explicitly, its implication is clear: should the Court rule in favor of the U.S. Justice Department, the U.S. may run afoul of the EU data protection regime, and face EU states’ national regulatory authorities’ ire.

The Commission’s brief: European Commission Amicus Brief in Support of Neither Party

Yesterday, the Supreme Court granted the Department of Justice’s petition for a writ of certiorari in its dispute with Microsoft over access to private emails stored at Microsoft’s Dublin, Ireland data center. At issue is whether the warrant provisions of the Stored Communications Act (SCA) apply extraterritorially, such that they compel Microsoft, an electronic service provider to produce private electronic communications stored on servers in Ireland for the United States government.

Background

In December 2013, the Justice Department served a warrant to Microsoft, compelling the company to disclose information pertaining to a user’s email account. The government asserted that it had probable cause to believe that the account was being used to facilitate criminal drug activity.

The Stored Communications Act (SCA) – which is part of the broader Electronic Communications Privacy Act (ECPA) of 1986 – allows the government to require that an electronic communications provider disclose information about a particular communication upon being served a probable-cause-based warrant.  A federal magistrate judge issued such a warrant in this case.

In response to the warrant, Microsoft turned over the information pertaining to the account stored on its U.S. servers, such as the user’s address book. The company refused, however, to turn over the information stored in Dublin. Microsoft assigns accounts to particular data centers based on their proximity to users’ country of residence. The account in question had been assigned to Microsoft’s Dublin center, and thus all of the account’s email content – the subject lines as well as content of emails – was stored solely in Dublin, not in the United States.

Microsoft argued that the U.S. government could not invoke the Stored Communications Act to compel the production of data stored in a foreign country. Instead, the company stated that the U.S. government had to obtain the consent of the Irish government first, by utilizing an alternate channel established for obtaining such communications: the United States’ Mutual Legal Assistance Treaty (MLAT) with Ireland.

A district court, however, affirmed the magistrate judge’s ruling on de novo review, and held Microsoft in contempt for failing to comply with the warrant.

The case then came before the Second Circuit Court of Appeals. In a unanimous decision, the Second Circuit reversed the district court’s ruling, reasoning that the lower court “lacked authority to enforce the Warrant against Microsoft,” on the grounds that “[n]either explicitly nor explicitly does the statue envision the application of its warrant provisions overseas.”

Now, the case is set to go before the Supreme Court during its 2017-2018 term.
Modernizing Data Privacy Protections: The Role of Congress or the Courts?

In a blog post posted on October 16, 2017, Microsoft’s President and Chief Legal Officer, Brad Smith, argued data privacy laws in the United States should be modernized. “The current law, ECPA, was enacted in 1986 when the World Wide Web was still a few years away from being invented and no one conceived of conducting most work and personal business online,” Smith writes. “A world connected by cloud services simply didn’t exist. The ways in which we communicate have radically changed over the past three decades — but the laws governing those communications haven’t. Current laws don’t adequately support the needs of law enforcement anywhere in the world or protect our rights.”

Smith stresses, however, that it is Congress, not the courts, who should take the helm in this effort. “We believe that rather than arguing over an old law in court, it is time for Congress to act by passing new legislation, such as the International Communications Privacy Act (ICPA) of 2017.”

Smith’s argument here – that data privacy laws should be modernized by passing new legislation in Congress, rather than by challenging existing statutes in the courts – echoes the argument put forth in Microsoft’s opposition brief. “Congress alone has the authority and the institutional competence to craft a new legislative scheme for a world not anticipated in 1986,” Microsoft’s counsel writes. “And it has remedial options simply not available to this Court.” Microsoft argues that the courts, in interpreting the Stored Communications Act, have traditionally employed an “all-or-nothing” approach with regards to the question of extraterritoriality–either law enforcement may compel production of all communications stored abroad, or it may demand none of it. This approach thus risks disrupting “the ‘harmony’ between nations that is ‘particularly needed in today’s highly interdependent commercial world.’”

Interestingly, the digital privacy groups that submitted a joint amicus curiae brief in support of Microsoft’s petition before the Second Circuit veered away from Microsoft’s choice-of-forum argument. Rather than supporting Microsoft’s assertion that it is the job of Congress, not the Court, to modernize the SCA, the privacy groups – namely, the Brennan Center for Justice, the American Civil Liberties Union, the Constitution Project, and the Electronic Frontier Foundation – make a different argument altogether. They state in their brief:

Modern technology has dramatically expanded the reach of the doctrine far beyond records of bank transactions and telephone calls.  The Supreme Court recognized this problem in Riley, reasoning that Fourth Amendment privacy protection must account for this new technological reality.  There, in holding that cell phones may not be searched under the search-incident-to -arrest warrant exception, the court noted that modern cell phones—just like cloud-based email—are capable of storing a vast amount of personal information and thus deserve the highest privacy protections.

Here, the amici curiae apply a Fourth Amendment analysis – an amendment that Microsoft does not even mention in its brief — to the question of whether the SCA applies extraterritorially. It remains to be seen whether the Supreme Court will be sympathetic to Microsoft’s and the supporting amici curiae’s arguments. Whether or not the Justices side with Microsoft, the line of reasoning they choose to privilege in their opinions –either the choice-of-forum  or the Fourth Amendment analysis – will have implications for how similar legal quandaries are framed in the future.

Take a look at the case filings here.